Daily Security Intelligence Briefing — August 8, 2026

1. Over 4,400 Rockwell PLCs Exposed Online; 22 Found in Attacked Water Utility Cities

Source & Article Link: The Hacker News / TLDR InfoSec

Technical Severity / Domain: Industrial Control Systems (ICS/SCADA) Security / Critical Infrastructure Risk

Why You Must Read This: Forescout identified 4,400+ internet-facing Rockwell Automation Programmable Logic Controllers (PLCs) globally, including 22 located in US cities whose municipal water utilities suffered recent operational disruptions. Attackers compromised controllers via open Ethernet/IP (port 44818) without exploiting complex zero-days, locking operators out by altering logic and communication settings.

Recommended Immediate Action: Immediately disconnect all ICS/PLC interfaces from direct public internet exposure behind perimeter firewalls or industrial VPNs, and follow Rockwell Advisory SD1790 to clear unauthorized locks.

2. EndlessDoors: Unpatchable C2 Backdoor Discovered in 100,000+ Zbtlink Routers

Source & Article Link: Decipher / TLDR InfoSec

Technical Severity / Domain: Network & Hardware Supply Chain Security / Critical (Hardware Backdoor)

Why You Must Read This: VulnCheck researchers disclosed an intentional, hardcoded C2 backdoor ("EndlessDoors") embedded in firmware across 100,000+ active Zbtlink and Wiflyer routers. The backdoor initiates outbound encrypted TCP beacons on port 7000 to bypass NAT and firewalls, granting remote attackers unauthenticated root shell access to the router and connected local networks.

Recommended Immediate Action: Monitor network perimeters for outbound TCP port 7000 beaconing, isolate affected hardware, and physically replace impacted Zbtlink/Wiflyer router units.

3. NatJack Attacks at Black Hat: Cracking NAT Connection-Tracking Trust Assumptions

Source & Article Link: Network World / TLDR IT

Technical Severity / Domain: Network Protocol Security & Firewall Architecture / High

Why You Must Read This: Research presented at Black Hat 2026 revealed "NatJack," a new class of network attacks targeting NAT state tables. By abusing stateful packet inspection and connection-tracking (conntrack) table allocation rules, NatJack enables unauthenticated off-path attackers to hijack active TCP/UDP connections, poison DNS responses, or trigger firewall state table exhaustion denial-of-service across 32 enterprise firewall models spanning 13 major networking vendors.

Recommended Immediate Action: Audit enterprise firewall NAT implementations for strict TCP state validation and apply vendor hotfixes for conntrack state table re-use.

4. Claude Enterprise Inference Hooks: Inline DLP & Security Controls for AI Workflows

Source & Article Link: Claude Engineering Blog / TLDR IT

Technical Severity / Domain: AI Security & Enterprise DLP Architecture / High

Why You Must Read This: Anthropic launched Inference Hooks for Claude Enterprise (public beta). The framework intercepts all model prompts, system messages, and tool-call responses across Claude surfaces (Chat, Claude Code, Cowork, and custom integrations) and routes them through a customer-controlled inline DLP proxy server before processing, enabling real-time PII masking, secret detection, and policy enforcement.

Recommended Immediate Action: Review Anthropic's Inference Hook specification to integrate enterprise DLP proxy rules across deployed Claude Workspaces.

1. Agentic Incident Response Notebooks Built with Marimo

Domain: Incident Response Architecture & AI Automation

Subject / Topic Summary: The DNB Cyber Defense Center developed an incident response workflow engine using marimo reactive Python notebooks. The architecture features a unified cross-platform query SDK translating analyst requests seamlessly across Splunk, Microsoft Defender, and SQL interfaces while enabling human analysts and AI subagents to collaboratively execute, modify, and review reactive investigation cells.

Key Technical & Strategic Takeaways:

Converts static playbook runbooks into executable, version-controlled Python notebook graphs.

Provides a shared, programmatic interface where human responders and autonomous AI agents collaborate during live incident response.

Essential Direct Quote: "The marimo-pair agentic interface allows AI agents to create, execute, and inspect the same reactive notebooks as human responders, enabling collaborative incident investigation and automated query translation."

Source: DNB Cyber Defense Center / TLDR InfoSec

2. China Cyberspace Regulator Launches Cybersecurity Review into Palo Alto Networks

Domain: Security Leadership & Geopolitical Risk

Subject / Topic Summary: China's Cyberspace Administration (CAC) initiated a formal cybersecurity investigation into Palo Alto Networks enterprise security products, alleging potential risks to critical infrastructure and national security. The action reflects growing geopolitical restrictions on Western security vendors operating in foreign markets.

Key Technical & Strategic Takeaways:

Multinational security architectures must account for regional compliance splits and hardware vendor restrictions in Chinese operational regions.

Essential Direct Quote: "China's cyberspace regulator launched a cybersecurity review of Palo Alto Networks products, citing potential risks to critical infrastructure without identifying specific vulnerabilities."

Source: TLDR IT / 9to5Google

3. Vanta Stealer: Cross-Platform Python Info-Stealer Targeting Credentials & Tokens

Domain: Threat Intelligence & Malware Analysis

Subject / Topic Summary: Point Wild dissected Vanta Stealer, a cross-platform Python infostealer compiled via PyInstaller and PyArmor. The malware dynamically downloads modular plugins to extract browser passwords, VPN configurations, and gaming tokens, actively calling Discord APIs to identify high-value administrator accounts before exfiltrating stolen data archives over HTTP.

Key Technical & Strategic Takeaways:

Detection Strategy: Block outbound C2 traffic to vanta[.]st and alert on unassigned PyInstaller-compiled binaries initiating unexpected HTTP POST requests.

Essential Direct Quote: "Vanta Stealer is a highly obfuscated Python information stealer that uses PyInstaller and PyArmor to evade detection while dynamically downloading modules to harvest browser credentials, VPN configurations, and Discord tokens."

Source: Point Wild Research / TLDR InfoSec

4. Greatness Phishing Service Spoofs RingCentral to Hijack Microsoft 365 Accounts

Domain: Cloud IAM & Email Security

Subject / Topic Summary: The Greatness Phishing-as-a-Service (PaaS) platform bypassed email security gateways by spoofing RingCentral voicemail notification emails. Organizations that maintained blanket domain allowlists for RingCentral were compromised despite authentication check failures (SPF/DKIM/DMARC), as victims were routed through Adversary-in-the-Middle (AiTM) reverse proxies that captured MFA tokens.

Key Technical & Strategic Takeaways:

Blanket domain allowlists in email gateways bypass authentication controls; defenders must enforce strict DMARC alignment on all incoming mail regardless of sender domain reputation.

Essential Direct Quote: "The Greatness phishing platform bypassed email filters by spoofing RingCentral voicemail alerts to target organizations that had blanket-whitelisted the domain... routing victims through an Adversary-in-the-Middle flow to steal MFA tokens."

Source: TLDR InfoSec / Greatness PaaS Analysis

Tier 3 — Industry Noise & Awareness Only

• Numbat "AI-EDR" Agent Visibility Tool: Perplexity open-sourced Numbat, an endpoint agent providing visibility into local AI agent actions, execution blocking, and forensic reconstruction (GitHub Numbat).

• Agent-Egress-Bench Security Corpus: Open-source test suite evaluating AI agent firewalls across 197 security vectors including prompt injection and tool poisoning (GitHub Repository).

• Greenlight Claude Refusal Mapping Tool: Utility mapping Claude Code guardrail refusal boundaries during security vulnerability testing (GitHub Repository).

• Mercusys Router Pre-Auth Stack Overflow (CVE-2026-12495): Pre-auth stack buffer overflow in httpd patched in Mercusys MB115-4G router firmware v1.11.0 (Rotcee Research).

• Swiss Government SharePoint Breach: Swiss Federal Office of Information Technology patched SharePoint instances following a breach compromising ~200 user credentials (TLDR InfoSec).

• Ill Bloom Crypto Wallet Draining Campaign: Active wallet-draining campaign exploiting legacy CryptoJS weak-randomness flaws in downstream libraries (Coinspect).

• Surprise AI Costs Delay Enterprise Deployments: Survey of 396 CIOs reveals 25% of enterprise AI projects delayed due to unexpected infrastructure and token cost overruns (CIO Dive).

• Google Assistant Mobile Shutdown Date: Google announced Google Assistant will shut down on Android/Wear OS on September 4 in favor of Gemini (9to5Google).